CVE-2025-69191CWE-862

WordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerability

High · published January 22, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

⚡ A missing authorization check in ListingHub means some users can peek where they shouldn't! 😱 Think of it like a restaurant where the waiter serves food to anyone who asks, forgetting to check if they have a reservation. This oversight allows unauthorized diners to enjoy the meal without paying! In this case, attackers could gain access to sensitive data or functionalities that should be restricted, leading to serious breaches of confidentiality. Imagine an intruder wandering through a secure area, able to view everything without any restrictions — absolutely devastating!

Put simply

Think of it like a restaurant where the waiter serves food to anyone who asks, forgetting to check if they have a reservation. This oversight allows unauthorized diners to enjoy the meal without paying! This vulnerability arises from incorrectly configured access controls, allowing unauthorized access to resources for users who should not have them. Essentially, it fails to validate whether a user is allowed to perform certain actions within the ListingHub system.

What to do

In this case, attackers could gain access to sensitive data or functionalities that should be restricted, leading to serious breaches of confidentiality. Imagine an intruder wandering through a secure area, able to view everything without any restrictions — absolutely devastating! To secure your system, update ListingHub to version 1.2.8 or later, ensuring that all access controls are properly configured. Conduct a thorough review of user permissions to close any gaps in authorization. It's crucial to implement proper authentication checks to prevent unauthorized access! You've got this! With these steps, you'll be well on your way to fixing this vulnerability and keeping your data safe. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerability
    cvelistv5